← Oct 20Wednesday, October 21, 2026 · all daysOct 22 → · today »
1.The Future of CSS(joshwcomeau.com)
601 points by soheilpro 4 days ago | 263 comments | permalink
tl;dr: Browser vendors are planning Interop 2027, and Mozilla is letting developers upvote CSS features to prioritize. Top candidates include CSS `@function` definitions, `corner-shape`/`border-shape` for squircles and custom borders, Level 2 Anchor Positioning, scroll-triggered animations, `reading-flow` for accessible tab order, `interpolate-size` for animating to `auto`, gap decorations for grid borders, and sticky/scroll-state container queries. Most are already shipping in Chromium and usable today as progressive enhancements.
HN Discussion:
  • ↑Vanilla CSS has become genuinely enjoyable and powerful to work with today
  • ↓New features add needless complexity and eyecandy while basic UX problems remain unsolved
  • ↓Adding functions/programming constructs to CSS blurs language boundaries and bloats browsers
  • ↑Appreciation for the author and the long effort of pushing CSS improvements forward
  • •Nostalgia for alternative declarative UI approaches (like QML) that could have been
2.Upcoming critical PHP security release (CVE-2026-109618 / -109619)(news-web.php.net)
1514 points by xd 5 days ago | 650 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↑Panic and alarm that this is a catastrophic vulnerability already being exploited in the wild
  • ↑Frustration demanding the patch be released immediately to limit damage
  • ~Defense of the delayed release, arguing early release wouldn't help and maintainers need sleep
  • •Practical mitigation advice: take servers offline or use Cloudflare WAF until patched
  • •Related information sharing about Node.js also having security releases
3.Show HN: SimCity, but with Permits(permit.petercai.com)
909 points by pcai 5 days ago | 410 comments | permalink
tl;dr: Permit Pending is a free browser-based city simulation where you play an elected mayor rather than an omnipotent builder, navigating zoning hearings, appeals, lawsuits, and reelection campaigns to get anything built. Every improvement creates opposition—new housing angers homeowners, industry brings smog complaints—and the underlying economy tracks residents, businesses, rents, and jobs while your projects languish in committee. It's a sandbox with no win condition: the goal is simply to stay in office long enough to shape the city you want.
HN Discussion:
  • ~Game breaks immersion with inconsistent details that don't match the actual city state
  • ↑Sees the game as reflecting a frustrating but real critique of democratic bureaucracy blocking progress
  • ↑Wishes the simulation could model real cities for actual policy experimentation and optimization
  • ↑Finds the concept clever and amusing, reflecting real-world construction/permitting experience
  • ↓UX criticism: too much complexity presented upfront without gradual onboarding
4.Voxtral 3(mistral.ai)
760 points by ilreb 5 days ago | 197 comments | permalink
tl;dr: Mistral has released Voxtral 3, a family of speech-to-text and text-to-speech models paired with a LiveKit-based voice agent SDK that unifies listening, reasoning, tool-calling, and speaking into a sub-second streaming pipeline. The models claim state-of-the-art multilingual transcription (50+ languages), diarization, and context biasing, beating Whisper, Gemini 3.5 Transcribe, and Scribe v2 on benchmarks, with TTS supporting 35+ languages and voice cloning from 30 minutes of audio. Pricing starts at $0.0035/min for batch transcription and $13/1M chars for TTS, available via EU-hosted API or self-deployment.
HN Discussion:
  • ↑Previous Voxtral model works well for offline/local commercial deployment on modest hardware
  • ↓Disappointment that the model is closed-source rather than open weights
  • ↓Mistral seems to have abandoned open-source releases, reducing community interest
  • ↑Excitement about potential practical applications like dictaphones and voice agents
  • •Questions and tangential discussion about speech recognition quality in other contexts (YouTube, subtitle syncing)
5.eMudhra intermediate CA compromise(emudhra.we-have-a-problem.com)
1206 points by galadran 5 days ago | 478 comments | permalink
tl;dr: Private keys for eight eMudhra intermediate CA certificates were compromised due to flawed key generation, allowing anyone to recover them from the certificates issued since April 2025. The affected intermediates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome, all of which have pushed revocations; however, non-browser clients that don't enforce Certificate Transparency or consume revocation data remain vulnerable until software updates (ca-certificates, curl, Go, Node, etc.) are applied. The page provides verification tools and manual workarounds for macOS, Linux, and BSD systems.
HN Discussion:
  • ~Mocks the severity of the 'compromise' since private keys were trivially small like the number 4
  • •Confusion about the severity given mixed signals across platforms, asking for clarification
  • ↑Browsers handle this well via revocation infrastructure, but non-browser clients remain dangerously exposed
  • ↑Vendored CA stores in many software binaries make patching this incident much harder
  • ↑Provides practical verification tools/demos showing curl and other clients accept fake certificates
6.Feds suspect ransom negotiator ran ShinyHunters extortion site(krebsonsecurity.com)
264 points by Bender 5 days ago | 138 comments | permalink
tl;dr: Federal investigators probing the ShinyHunters extortion group—which recently breached the FBI's recruitment site—believe executives at two ransomware negotiation firms had suspiciously close ties with the hackers, with one US executive allegedly helping operate the group's victim-shaming site "shinywire.com." Canadian cybersecurity executive Edward Dubrovsky was already arrested in October, and chat logs from arrested ShinyHunters member Pepijn van der Stap reportedly show negotiators knew about breaches before victims did. The case highlights conflicts of interest in an industry where negotiators often take a percentage of ransom payments, incentivizing larger payouts.
HN Discussion:
  • ↑Government cybersecurity incompetence persists years after major breaches like OPM
  • •Questions the incentive structure that would motivate negotiators to collude with hackers
  • ↑Classic protection racket scheme: create the problem then sell the solution
  • ~Most ransom negotiators are legitimate professionals being unfairly tarnished by bad actors
  • ↓Federal law enforcement leaks about suspects are often unreliable and harmful
7.Google open-sources TorchTPU, a native PyTorch back end for TPUs(github.com)
376 points by ilreb 5 days ago | 89 comments | permalink
tl;dr: Google has open-sourced TorchTPU, a native PyTorch backend for TPUs that provides custom ATen kernel implementations, a compilation cache for XLA computations, and support for data and tensor parallelism. It integrates with torch.compile() for graph-mode execution and ships with examples for models like Llama, Qwen, ResNet, and minGPT. Available via pip (torch_tpu 0.2.0) or buildable from source with Bazel, requiring Python 3.11+.
HN Discussion:
  • ↑Related open-source efforts for other accelerators (Tenstorrent, AWS Trainium) complement this release
  • ↑First-party PyTorch support on TPUs is a long-awaited improvement over fighting with XLA
  • ~This signals TensorFlow's demise and raises questions about JAX's future relevance
  • •Questions about TPU availability and accessibility outside of Google Cloud
  • •Broader market implications: edge inference shift and TPU commoditization will disrupt AI investments
8.What shall I teach my son?(stevekrouse.com)
473 points by Curiositry 5 days ago | 622 comments | permalink
tl;dr: A soon-to-be father and programmer grapples with education's purpose as AI threatens the "earn a living" justification that quietly anchored his worldview. Drawing on Neil Postman's The End of Education, he notes schools have outlasted repeated predictions of their demise (radio, MOOCs, etc.) because their real purposes are subtler than stated ones. His tentative conclusion: invent new purposes collaboratively with children rather than imposing them, since how we teach matters more than what.
HN Discussion:
  • ↑Focus on cultivating character traits like curiosity, agency, and compassion rather than hard skills
  • ~Children will find their own path regardless; parents shouldn't project their anxieties onto them
  • ↑Spend meaningful time together through reading, nature, and shared experiences in early years
  • ↑School's real purpose is childcare and socialization, not the stated educational goals
  • ↑Revive humanities and liberal education to cultivate independent, critical thinkers
9.SlopCodeBench 10/2026 – Opus 5.5, Astra wins overall, xhigh considered harmful(github.com)
304 points by dhorthy 10 days ago | 120 comments | permalink
tl;dr: On the full 36-problem SlopCodeBench, GPT-6 Astra XHigh led strict pass rate at 16.3%, narrowly beating GPT-6.1 SOL Medium (14.8%) and Opus 5.5 Medium (14.3%), while Opus 5.5 Medium topped the looser "core" rate at 74%. Higher reasoning effort (XHigh) cost 2-4x more but didn't reliably improve strict scores—Opus 5.5 actually did worse on XHigh than Medium, though its XHigh output was ~5x cleaner by slop metrics. Models still routinely break regression tests as requirements evolve, with only 0-3 of 36 final checkpoints passing strictly.
HN Discussion:
  • ↑Astra produces unreadable code-golf style output despite good writing quality
  • ↑Higher reasoning effort has diminishing returns; medium is often optimal
  • ↑LLM slop stems from overly defensive programming and reluctance to simplify
  • ↓Benchmark omits important configurations like high, max, and default Sol Low
  • •Questions about reproducibility and practical ways to run the benchmark
10.Apple broke an essential presentation feature of iPads(teddysvoronos.com)
598 points by evanb 5 days ago | 293 comments | permalink
tl;dr: iPadOS 27 broke a key presentation workflow: when AirPlaying, tapping any app other than the presenting one now mirrors the entire iPad screen to the external display, exposing private notes, poll results, or presenter views. This affects GoodNotes, Keynote, and PowerPoint differently, but all are disruptive—Keynote exits presentations entirely, while PowerPoint enters a broken state requiring a restart. The author proposes that apps in presenter mode should retain external display precedence until explicitly stopped, and has filed feedback with Apple (FB23615646).
HN Discussion:
  • ↑Apple's design philosophy prioritizes magical simplicity over user control, causing issues like this
  • ↑iPad will never be a true professional tool because Apple refuses to give users real control
  • ↑Apple's software quality has broadly declined with recent OS releases, with many bugs beyond this one
  • ↓Software quality issues are inevitable due to hardware deadline pressures, defending Apple's tradeoffs
  • ~The real problem is closed hardware/software ecosystems, not this specific bug
11.DeepInfer: High-performance inference framework for DeepSeek models(github.com)
2303 points by ggcr 5 days ago | 884 comments | permalink
tl;dr: DeepSeek has open-sourced DeepInfer, the inference framework powering its production services, built on vLLM with influences from SGLang and TensorRT-LLM. It supports DeepSeek-V4.1-Flash on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs, featuring optimized kernels (FlashMLA, DeepGEMM), speculative decoding with confidence-scheduled verification, batch-invariant and deterministic inference, async scheduling, and structured outputs. The release covers offline inference only—a KV cache system, prefill/decode disaggregation, and load balancing are required but not included for a full serving stack.
HN Discussion:
  • ↑Impressed by DeepInfer's throughput and revenue metrics in production
  • •Release is a strategic/geopolitical move timed against US restrictions on DeepSeek
  • ↑Open-sourcing undermines US frontier labs' business models and valuations
  • ↑Supporting Huawei Ascend NPUs could challenge Nvidia's hardware dominance
  • ↓Skeptical of China/DeepSeek's motives for open-sourcing this framework
12.Ofcom concedes defeat in 4chan case(prestonbyrne.com)
416 points by iamnothere 5 days ago | 407 comments | permalink
tl;dr: Ofcom has effectively conceded it cannot enforce Online Safety Act fines against 4chan, acknowledging in parliamentary testimony that foreign courts can block recovery—a direct consequence of dicta in 4chan v. Ofcom suggesting US courts would refuse to enforce such judgments on First Amendment grounds. The author, 4chan's lawyer, argues this vindicates proposed US legislation (the GRANITE and HOMEFRONT Acts) to strip sovereign immunity from foreign censors. Ofcom is expected to next seek unilateral UK site-blocking powers from Parliament, which the author notes would be easily circumvented via VPN.
HN Discussion:
  • ↑Enforcement attempt was poorly conceived; Ofcom overreached without practical leverage
  • ↑This reflects broader UK/European government incompetence or regulatory overreach
  • ↑This is groundwork for domestic censorship infrastructure like DPI and site-blocking
  • ↓Economic coercion via trade deals is an equally valid enforcement mechanism being ignored by the author
  • ↓The author's framing of America as free defender is hypocritical given US domestic authoritarianism
13.Sixteen years after Deepwater Horizon, deep sea life shows few signs of recovery(e360.yale.edu)
318 points by speckx 5 days ago | 187 comments | permalink
tl;dr: A new PNAS study finds that deep-sea populations of octopus, squid, krill, shrimp, and lanternfish in the Gulf of Mexico dropped by at least 60% after the 2010 Deepwater Horizon spill and have shown little recovery 16 years later. Researchers also detected reduced genetic diversity and found oil-related compounds in deep-sea species, which can impair reproduction and development. While not definitively proven, the spill is described as "the most parsimonious explanation" for what they call the fastest, most severe decline ever documented in this ocean layer.
HN Discussion:
  • ↑Historical precedent confirms deep-sea habitats don't recover from oil spills
  • ↑Dispersants hid the oil rather than cleaning it, worsening deep-sea damage
  • ~Researchers and systems avoid assigning accountability to oil companies
  • ↓Article is poorly written and fails to quantify the recovery claim
  • ↑Humanity's destructive impact on ecosystems is exhausting and shameful
14.Tsrs: A Port of TypeScript to Rust(blog.cloudflare.com)
429 points by hnisjafx40 5 days ago | 211 comments | permalink
tl;dr: Cloudflare, VoidZero, and Owner.com are developing tsrs, a Rust port of the TypeScript compiler, in collaboration with the TypeScript team as part of the Oxc toolchain. Early benchmarks show tsrs is up to 8x faster and uses ~70% less memory than TypeScript 7.0, with Rust chosen primarily for its superior WebAssembly story (no GC overhead), enabling sandboxed dev environments in browsers, Workers, and embedded devices. The project aims to stay faithful to upstream TypeScript rather than fork it, using agents to track and sync changes similar to their Vinext/Next.js workflow.
HN Discussion:
  • ~TypeScript team confirms speed gains are largely from optimizations, not just language choice
  • ↑The Rust memory model/arena approach is a clever technical solution to the GC porting problem
  • ↑WASM compatibility was the real motivation, with speed being a bonus
  • ↓Concern about shift from handwritten ports to fully AI-generated code without proper review
  • ↓AI-driven duplication of effort undermines the value of open source work
15.How I got over 300 Tor exit nodes removed(kaba.cx)
395 points by kabakabakaba 5 days ago | 101 comments | permalink
tl;dr: A researcher discovered that ~333 Tor exit nodes (roughly 10% of the network) had been compromised with the Ebury OpenSSH backdoor and were coordinating to intercept unencrypted mail traffic and MITM SSH connections on port 22. Using exitmap to script test SSH connections between two of his own servers, he detected which exits were redirecting traffic to 12 interception servers, then reported findings to the Tor Project, which flagged the relays as BadExit within days. The origin of the initial server compromise remains unknown, with speculation pointing to a possible hosting provider breach.
HN Discussion:
  • ↑Praise and appreciation for the author's work and writeup
  • ↑Technical analysis reinforcing that SSH key authentication defeats the MITM attack described
  • ↑Critique that the attackers' SSH strategy was poorly conceived and self-defeating
  • ~Questioning whether SSH keys actually would have prevented this MITM given fingerprint warnings
  • •Speculation and additional context on how the exit nodes were compromised (cloud providers, hosting breaches)
16.Academics have a duty to defend open knowledge systems like Wikipedia(blogs.lse.ac.uk)
227 points by jruohonen 5 days ago | 150 comments | permalink
tl;dr: Generative AI tools like ChatGPT and Gemini are siphoning readers from Wikipedia while simultaneously scraping its content for training, threatening the volunteer community that sustains it. The author argues academics have an ethical duty to defend Wikipedia by contributing expertise, citing it in scholarly work, and teaching students to edit it—noting that Wiki Education programs already supply roughly 19% of new active editors. For this to work, universities must formally recognize Wikipedia contributions as legitimate public service in tenure and evaluation processes.
HN Discussion:
  • ↑Supports citing Wikipedia and broadening academic evaluation to recognize open knowledge contributions
  • ~Notes irony that academia previously rejected Wikipedia and now is asked to defend it
  • ↓Wikipedia is compromised by ideological bias and not worth defending
  • ↓Real fight should be against Elsevier/publisher monopolies, not saving flawed Wikipedia
  • ↓Converting consumers into contributors is empirically very difficult, undermining the article's practical plan
17.Publish fake stats, get cited in LLMs(peec.ai)
363 points by robtherobber 5 days ago | 202 comments | permalink
tl;dr: An experimenter spun up a site with 50,000 fabricated statistics using GPT-4.1 for about $50. Google deindexed it after two updates, but ChatGPT kept retrieving it heavily—driving 10,000+ sessions, 330+ referring domains (including Shopify, DHL, Bluehost), and citations in an academic paper and a Qatari bank's investment research. The takeaway: LLM retrieval operates independently of Google rankings, models prefer specific numbers to fill gaps without fact-checking, and citation laundering can make fabricated stats appear authoritative over time.
HN Discussion:
  • ↑This problem isn't new; it's citogenesis/misinformation extended to LLMs, now at greater scale and speed
  • ↓The experiment lacks evidence that ChatGPT actually used the fake stats rather than just crawling them
  • ↑The problem is structurally unfixable since LLMs can't easily verify source quality and incentives reward cheating
  • ↑Public awareness of this LLM citation vulnerability is valuable and needed
  • ~Questions whether the issue is LLM-specific versus a general internet misinformation problem
18.Facebook Pages require paid subscription to post more than two links per month(mastodon.gamedev.place)
460 points by AshleysBrain 5 days ago | 401 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ~Speculates the change may be intended to combat clickbait engagement farming tactics
  • ↑Welcomes the change as it pushes businesses away from relying on Facebook Pages
  • ↑Views this as part of a broader war on hyperlinks and open web
  • ↑Doubts the restriction is sustainable given legitimate group use cases needing links
  • ↓Disputes the article's framing, claiming the restriction only applies to specific account types not all Pages
19.An ad-free Android TV(cretezy.com)
434 points by CraftThatBlock 6 days ago | 190 comments | permalink
tl;dr: The author details an ADB-based setup to strip ads from Android TV: replacing Google TV's launcher with Projectivy, swapping YouTube for SmartTube, using Wholphin for Jellyfin, and remapping the remote with Button Mapper. Additional steps cover disabling the stock launcher and bloatware packages, plus using Pi-hole or AdGuard DNS to block the home-screen banner and tracking across the network.
HN Discussion:
  • ↑Google's post-hoc addition of ads is underhanded and replacing the launcher is a major quality-of-life improvement
  • ~Skip smart TV software entirely; use a dumb TV or never connect it, and use external devices like Apple TV
  • ~Simpler DNS-based blocking can achieve ad removal without the full ADB setup
  • ↑Suggests additional/alternative tools (Moonfin, custom Linux interfaces) that complement the article's approach
  • ~The whole situation requires too much effort and reflects a broken razor-blade business model for TVs
20.Google Cloud outage affects almost all banking and other operations in Europe(neowin.net)
401 points by paweladamczuk 5 days ago | 204 comments | permalink
tl;dr: Summary not available
HN Discussion:
  • ↑Shares factual status page info confirming the outage in europe-west2 zone
  • ↑Personal account confirming severe banking disruption from the outage
  • ↑Calls for European cloud sovereignty alternatives to US hyperscalers
  • ↓Disputes the article's scope, claiming downtime reports are overstated and based on unreliable sources
  • •Raises regulatory implications under DORA for critical third-party vendor failures